SOA Record Lookup

Find the Start of Authority (SOA) record detailing core properties of the DNS zone.

About SOA Records

The Start of Authority (SOA) record is fundamentally required for a DNS zone to operate correctly. It contains essential administrative information about the zone.

Key components include the Primary Nameserver, the administrator's email address, the zone's serial number (used by secondary servers to detect changes), and various timing parameters dictating how often secondary servers should refresh and retry data transfers.

Our SOA Record Lookup returns the Start of Authority record for any domain — the primary nameserver, the administrator email, the zone serial number, and every timer that controls how secondary servers and resolvers treat your zone.

What is an SOA Record?

The SOA (Start of Authority) record is the administrative header of a DNS zone. Every zone has exactly one, and it must be present for the zone to be valid.

It holds two identifiers — the primary nameserver and the zone administrator email address — plus five numeric values that govern zone replication and negative caching: the serial number, refresh, retry, expire, and minimum TTL.

Secondary nameservers use these timers to decide when to pull a fresh copy of the zone and how long to keep serving it if the primary becomes unreachable. Resolvers use the minimum field to decide how long to cache a negative answer, meaning a record that does not exist.

The mandatory administrative record at the top of every DNS zone
Contains the primary nameserver and the administrator email address
The serial number tells secondaries when the zone has changed
Refresh, retry and expire timers control zone replication
The minimum field sets how long NXDOMAIN answers are cached

Why the SOA Record Matters

The SOA record is where most silent DNS replication failures reveal themselves. If the serial number is not incremented after an edit, secondary nameservers never notice the change and keep serving the old zone — so your update works for some users and not others, with no error anywhere.

The minimum field has an effect people rarely anticipate: it controls negative caching. Set too high, a typo that briefly published a missing record stays cached as nonexistent for hours after you fix it.

A stale serial number means secondary servers never pick up your changes
An expire value that is too short can take the entire zone offline during a primary outage
A high minimum TTL keeps NXDOMAIN answers cached long after a fix
The administrator email is the contact of record for DNS problems
SOA timers directly determine how fast a DNS change reaches users

How This SOA Record Lookup Works

The tool queries DNS for the SOA record and decodes every field, including the encoded administrator email address.

Validates the domain input against format and SSRF safety checks
Queries authoritative DNS for the SOA record of the zone
Decodes the rname field into a normal email address
Reports the serial number and all four replication timers
Highlights values outside the ranges recommended in RFC 1912

How to Use the SOA Record Lookup

Enter a domain name such as example.com in the input field
Run the lookup to query live DNS
Check that the primary nameserver is the one you expect
Note the serial number — it should change after every zone edit
Review the timers against the recommended ranges shown in the results

Understanding Your SOA Record Fields

The SOA record packs seven values into one record. Here is what each one controls:

Field / Value	Meaning
`MNAME (primary NS)`	The hostname of the primary authoritative nameserver — the server where zone edits originate. Secondary servers pull their copy from here.
`RNAME (admin email)`	The zone administrator email, encoded with the @ replaced by a dot. So hostmaster.example.com means hostmaster@example.com.
`Serial`	A version number for the zone. It must increase after every change, or secondaries will not refresh. The conventional format is YYYYMMDDnn, such as 2026092901.
`Refresh`	How often, in seconds, a secondary checks the primary for a new serial. Typical values are 3600 to 86400. Modern setups rely on NOTIFY messages instead, making this largely a fallback.
`Retry`	How long a secondary waits before retrying after a failed refresh. Should always be shorter than refresh. Typically 600 to 7200 seconds.
`Expire`	How long a secondary keeps serving the zone when it cannot reach the primary. Once this elapses the secondary stops answering entirely. Should be at least a week — 1209600 (14 days) is a common safe choice.
`Minimum TTL`	Since RFC 2308 this controls negative caching — how long resolvers remember that a name does not exist. 300 to 3600 seconds is sensible; higher values make typos painful to correct.

Common Problems & How to Fix Them

Secondary nameservers compare serial numbers to decide whether to pull a new copy. If the serial does not increase, they assume nothing changed and keep serving stale data indefinitely.

Most managed DNS providers increment it automatically. If you edit zone files by hand, increase the serial on every change. Use the YYYYMMDDnn convention so the value is self-documenting and always increases.

Expire controls how long secondaries keep answering when the primary is unreachable. A value of a few hours means a longer primary outage takes your whole domain offline, even though the secondaries hold a perfectly good copy.

Set expire to at least 604800 seconds (7 days), and 1209600 (14 days) for important zones. There is no real downside to a generous value.

This field governs negative caching. At 86400 seconds, a record that was briefly missing stays cached as nonexistent for a full day after you add it — a common and confusing failure after a migration.

Lower it to between 300 and 3600 seconds. The original meaning of this field as a default TTL was superseded by RFC 2308.

The RNAME field is the published contact for DNS issues. A nonexistent address means registries, CAs and other operators cannot reach you about zone problems.

Set it to a monitored mailbox such as hostmaster@yourdomain.com, and remember the @ is written as a dot in the record itself.

Retry must be shorter than refresh — otherwise a secondary that fails a refresh waits longer to retry than it would have waited for the next scheduled check, which makes no sense and some validators reject.

A common correct pairing is refresh 7200 and retry 3600.

Best Practices

Increment the serial number on every zone change, using the YYYYMMDDnn convention
Set expire to at least 604800 seconds so a primary outage does not take the zone down
Keep the minimum TTL between 300 and 3600 seconds to limit negative caching
Always set retry shorter than refresh
Point RNAME at a genuinely monitored mailbox such as hostmaster@yourdomain.com
Confirm the primary nameserver named in MNAME is also listed in your NS records
Compare SOA serials across all your nameservers to confirm they are in sync

Security Recommendations

Compare the SOA serial across every authoritative server — a mismatch means replication has failed and some users are getting stale answers
Watch for unexpected serial jumps, which can indicate unauthorised zone modification
Do not expose internal hostnames or personal email addresses in the SOA record, as it is world-readable
Confirm that secondary nameservers are not also permitting unrestricted zone transfers
Enable DNSSEC so the SOA record and the rest of the zone can be cryptographically validated
Monitor the MNAME value for changes, since a primary nameserver swap can precede a domain hijack

Frequently Asked Questions

An SOA (Start of Authority) record is the administrative header of a DNS zone. It names the primary nameserver and the zone administrator, and carries the serial number and the timers that control zone replication and negative caching. Every zone must have exactly one.

The serial is a version number for the zone. Secondary nameservers compare their copy against the primary and pull an update only when the serial has increased. If it never increases, secondaries serve stale data forever. The conventional format is YYYYMMDDnn.

Since RFC 2308 it controls negative caching — how long resolvers remember that a name does not exist. It no longer acts as a default TTL for other records. Keep it between 300 and 3600 seconds so that a newly added record is not masked by a cached NXDOMAIN.

The DNS wire format has no way to represent an @ inside a name, so the first dot stands in for it. hostmaster.example.com means hostmaster@example.com. If the local part itself contains a dot, it is escaped with a backslash.

A secondary nameserver that has been unable to reach the primary for longer than the expire value stops answering for the zone entirely. If all your secondaries expire, the domain goes dark. Set expire to at least seven days to make that outcome very unlikely.

With a managed DNS provider, sensible defaults are set for you and the serial is incremented automatically. Manual tuning matters mainly when you run your own authoritative servers or operate a primary and secondary pair across providers.

Query the SOA record from each authoritative nameserver and compare the serial numbers. If they differ, replication has failed and some users are receiving outdated answers.